<!doctype html>
<html>
<head>
<meta charset='UTF-8'><meta name='viewport' content='width=device-width initial-scale=1'>
<title>cloud_04</title><style type='text/css'>html {overflow-x: initial !important;}:root { --node-fill: #ECECFF; --node-border: #CCCCFF; --cluster-fill: #ffffde; --cluster-border: #aaaa33; --note-fill: #fff5ad; --note-border: #aaaa33; --mermaid-color: var(--text-color); }


:root { --bg-color:#ffffff; --text-color:#333333; --select-text-bg-color:#B5D6FC; --select-text-font-color:auto; --monospace:"Lucida Console",Consolas,"Courier",monospace; --title-bar-height:20px; }
.mac-os-11 { --title-bar-height:28px; }
html { font-size: 14px; background-color: var(--bg-color); color: var(--text-color); font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; -webkit-font-smoothing: antialiased; }
body { margin: 0px; padding: 0px; height: auto; bottom: 0px; top: 0px; left: 0px; right: 0px; font-size: 1rem; line-height: 1.42857; overflow-x: hidden; background: inherit; tab-size: 4; }
iframe { margin: auto; }
a.url { word-break: break-all; }
a:active, a:hover { outline: 0px; }
.in-text-selection, ::selection { text-shadow: none; background: var(--select-text-bg-color); color: var(--select-text-font-color); }
#write { margin: 0px auto; height: auto; width: inherit; word-break: normal; overflow-wrap: break-word; position: relative; white-space: normal; overflow-x: visible; padding-top: 36px; }
#write.first-line-indent p { text-indent: 2em; }
#write.first-line-indent li p, #write.first-line-indent p * { text-indent: 0px; }
#write.first-line-indent li { margin-left: 2em; }
.for-image #write { padding-left: 8px; padding-right: 8px; }
body.typora-export { padding-left: 30px; padding-right: 30px; }
.typora-export .footnote-line, .typora-export li, .typora-export p { white-space: pre-wrap; }
.typora-export .task-list-item input { pointer-events: none; }
@media screen and (max-width: 500px) {
  body.typora-export { padding-left: 0px; padding-right: 0px; }
  #write { padding-left: 20px; padding-right: 20px; }
  .CodeMirror-sizer { margin-left: 0px !important; }
  .CodeMirror-gutters { display: none !important; }
}
#write li > figure:last-child { margin-bottom: 0.5rem; }
#write ol, #write ul { position: relative; }
img { max-width: 100%; vertical-align: middle; image-orientation: from-image; }
button, input, select, textarea { color: inherit; font: inherit; }
input[type="checkbox"], input[type="radio"] { line-height: normal; padding: 0px; }
*, ::after, ::before { box-sizing: border-box; }
#write h1, #write h2, #write h3, #write h4, #write h5, #write h6, #write p, #write pre { width: inherit; }
#write h1, #write h2, #write h3, #write h4, #write h5, #write h6, #write p { position: relative; }
p { line-height: inherit; }
h1, h2, h3, h4, h5, h6 { break-after: avoid-page; break-inside: avoid; orphans: 4; }
p { orphans: 4; }
h1 { font-size: 2rem; }
h2 { font-size: 1.8rem; }
h3 { font-size: 1.6rem; }
h4 { font-size: 1.4rem; }
h5 { font-size: 1.2rem; }
h6 { font-size: 1rem; }
.md-math-block, .md-rawblock, h1, h2, h3, h4, h5, h6, p { margin-top: 1rem; margin-bottom: 1rem; }
.hidden { display: none; }
.md-blockmeta { color: rgb(204, 204, 204); font-weight: 700; font-style: italic; }
a { cursor: pointer; }
sup.md-footnote { padding: 2px 4px; background-color: rgba(238, 238, 238, 0.7); color: rgb(85, 85, 85); border-radius: 4px; cursor: pointer; }
sup.md-footnote a, sup.md-footnote a:hover { color: inherit; text-transform: inherit; text-decoration: inherit; }
#write input[type="checkbox"] { cursor: pointer; width: inherit; height: inherit; }
figure { overflow-x: auto; margin: 1.2em 0px; max-width: calc(100% + 16px); padding: 0px; }
figure > table { margin: 0px; }
tr { break-inside: avoid; break-after: auto; }
thead { display: table-header-group; }
table { border-collapse: collapse; border-spacing: 0px; width: 100%; overflow: auto; break-inside: auto; text-align: left; }
table.md-table td { min-width: 32px; }
.CodeMirror-gutters { border-right: 0px; background-color: inherit; }
.CodeMirror-linenumber { user-select: none; }
.CodeMirror { text-align: left; }
.CodeMirror-placeholder { opacity: 0.3; }
.CodeMirror pre { padding: 0px 4px; }
.CodeMirror-lines { padding: 0px; }
div.hr:focus { cursor: none; }
#write pre { white-space: pre-wrap; }
#write.fences-no-line-wrapping pre { white-space: pre; }
#write pre.ty-contain-cm { white-space: normal; }
.CodeMirror-gutters { margin-right: 4px; }
.md-fences { font-size: 0.9rem; display: block; break-inside: avoid; text-align: left; overflow: visible; white-space: pre; background: inherit; position: relative !important; }
.md-diagram-panel { width: 100%; margin-top: 10px; text-align: center; padding-top: 0px; padding-bottom: 8px; overflow-x: auto; }
#write .md-fences.mock-cm { white-space: pre-wrap; }
.md-fences.md-fences-with-lineno { padding-left: 0px; }
#write.fences-no-line-wrapping .md-fences.mock-cm { white-space: pre; overflow-x: auto; }
.md-fences.mock-cm.md-fences-with-lineno { padding-left: 8px; }
.CodeMirror-line, twitterwidget { break-inside: avoid; }
.footnotes { opacity: 0.8; font-size: 0.9rem; margin-top: 1em; margin-bottom: 1em; }
.footnotes + .footnotes { margin-top: 0px; }
.md-reset { margin: 0px; padding: 0px; border: 0px; outline: 0px; vertical-align: top; background: 0px 0px; text-decoration: none; text-shadow: none; float: none; position: static; width: auto; height: auto; white-space: nowrap; cursor: inherit; -webkit-tap-highlight-color: transparent; line-height: normal; font-weight: 400; text-align: left; box-sizing: content-box; direction: ltr; }
li div { padding-top: 0px; }
blockquote { margin: 1rem 0px; }
li .mathjax-block, li p { margin: 0.5rem 0px; }
li blockquote { margin: 1rem 0px; }
li { margin: 0px; position: relative; }
blockquote > :last-child { margin-bottom: 0px; }
blockquote > :first-child, li > :first-child { margin-top: 0px; }
.footnotes-area { color: rgb(136, 136, 136); margin-top: 0.714rem; padding-bottom: 0.143rem; white-space: normal; }
#write .footnote-line { white-space: pre-wrap; }
@media print {
  body, html { border: 1px solid transparent; height: 99%; break-after: avoid; break-before: avoid; font-variant-ligatures: no-common-ligatures; }
  #write { margin-top: 0px; padding-top: 0px; border-color: transparent !important; }
  .typora-export * { -webkit-print-color-adjust: exact; }
  .typora-export #write { break-after: avoid; }
  .typora-export #write::after { height: 0px; }
  .is-mac table { break-inside: avoid; }
}
.footnote-line { margin-top: 0.714em; font-size: 0.7em; }
a img, img a { cursor: pointer; }
pre.md-meta-block { font-size: 0.8rem; min-height: 0.8rem; white-space: pre-wrap; background: rgb(204, 204, 204); display: block; overflow-x: hidden; }
p > .md-image:only-child:not(.md-img-error) img, p > img:only-child { display: block; margin: auto; }
#write.first-line-indent p > .md-image:only-child:not(.md-img-error) img { left: -2em; position: relative; }
p > .md-image:only-child { display: inline-block; width: 100%; }
#write .MathJax_Display { margin: 0.8em 0px 0px; }
.md-math-block { width: 100%; }
.md-math-block:not(:empty)::after { display: none; }
.MathJax_ref { fill: currentcolor; }
[contenteditable="true"]:active, [contenteditable="true"]:focus, [contenteditable="false"]:active, [contenteditable="false"]:focus { outline: 0px; box-shadow: none; }
.md-task-list-item { position: relative; list-style-type: none; }
.task-list-item.md-task-list-item { padding-left: 0px; }
.md-task-list-item > input { position: absolute; top: 0px; left: 0px; margin-left: -1.2em; margin-top: calc(1em - 10px); border: none; }
.math { font-size: 1rem; }
.md-toc { min-height: 3.58rem; position: relative; font-size: 0.9rem; border-radius: 10px; }
.md-toc-content { position: relative; margin-left: 0px; }
.md-toc-content::after, .md-toc::after { display: none; }
.md-toc-item { display: block; color: rgb(65, 131, 196); }
.md-toc-item a { text-decoration: none; }
.md-toc-inner:hover { text-decoration: underline; }
.md-toc-inner { display: inline-block; cursor: pointer; }
.md-toc-h1 .md-toc-inner { margin-left: 0px; font-weight: 700; }
.md-toc-h2 .md-toc-inner { margin-left: 2em; }
.md-toc-h3 .md-toc-inner { margin-left: 4em; }
.md-toc-h4 .md-toc-inner { margin-left: 6em; }
.md-toc-h5 .md-toc-inner { margin-left: 8em; }
.md-toc-h6 .md-toc-inner { margin-left: 10em; }
@media screen and (max-width: 48em) {
  .md-toc-h3 .md-toc-inner { margin-left: 3.5em; }
  .md-toc-h4 .md-toc-inner { margin-left: 5em; }
  .md-toc-h5 .md-toc-inner { margin-left: 6.5em; }
  .md-toc-h6 .md-toc-inner { margin-left: 8em; }
}
a.md-toc-inner { font-size: inherit; font-style: inherit; font-weight: inherit; line-height: inherit; }
.footnote-line a:not(.reversefootnote) { color: inherit; }
.md-attr { display: none; }
.md-fn-count::after { content: "."; }
code, pre, samp, tt { font-family: var(--monospace); }
kbd { margin: 0px 0.1em; padding: 0.1em 0.6em; font-size: 0.8em; color: rgb(36, 39, 41); background: rgb(255, 255, 255); border: 1px solid rgb(173, 179, 185); border-radius: 3px; box-shadow: rgba(12, 13, 14, 0.2) 0px 1px 0px, rgb(255, 255, 255) 0px 0px 0px 2px inset; white-space: nowrap; vertical-align: middle; }
.md-comment { color: rgb(162, 127, 3); opacity: 0.8; font-family: var(--monospace); }
code { text-align: left; vertical-align: initial; }
a.md-print-anchor { white-space: pre !important; border-width: initial !important; border-style: none !important; border-color: initial !important; display: inline-block !important; position: absolute !important; width: 1px !important; right: 0px !important; outline: 0px !important; background: 0px 0px !important; text-decoration: initial !important; text-shadow: initial !important; }
.md-inline-math .MathJax_SVG .noError { display: none !important; }
.html-for-mac .inline-math-svg .MathJax_SVG { vertical-align: 0.2px; }
.md-math-block .MathJax_SVG_Display { text-align: center; margin: 0px; position: relative; text-indent: 0px; max-width: none; max-height: none; min-height: 0px; min-width: 100%; width: auto; overflow-y: hidden; display: block !important; }
.MathJax_SVG_Display, .md-inline-math .MathJax_SVG_Display { width: auto; margin: inherit; display: inline-block !important; }
.MathJax_SVG .MJX-monospace { font-family: var(--monospace); }
.MathJax_SVG .MJX-sans-serif { font-family: sans-serif; }
.MathJax_SVG { display: inline; font-style: normal; font-weight: 400; line-height: normal; zoom: 90%; text-indent: 0px; text-align: left; text-transform: none; letter-spacing: normal; word-spacing: normal; overflow-wrap: normal; white-space: nowrap; float: none; direction: ltr; max-width: none; max-height: none; min-width: 0px; min-height: 0px; border: 0px; padding: 0px; margin: 0px; }
.MathJax_SVG * { transition: none 0s ease 0s; }
.MathJax_SVG_Display svg { vertical-align: middle !important; margin-bottom: 0px !important; margin-top: 0px !important; }
.os-windows.monocolor-emoji .md-emoji { font-family: "Segoe UI Symbol", sans-serif; }
.md-diagram-panel > svg { max-width: 100%; }
[lang="flow"] svg, [lang="mermaid"] svg { max-width: 100%; height: auto; }
[lang="mermaid"] .node text { font-size: 1rem; }
table tr th { border-bottom: 0px; }
video { max-width: 100%; display: block; margin: 0px auto; }
iframe { max-width: 100%; width: 100%; border: none; }
.highlight td, .highlight tr { border: 0px; }
mark { background: rgb(255, 255, 0); color: rgb(0, 0, 0); }
.md-html-inline .md-plain, .md-html-inline strong, mark .md-inline-math, mark strong { color: inherit; }
mark .md-meta { color: rgb(0, 0, 0); opacity: 0.3 !important; }
@media print {
  .typora-export h1, .typora-export h2, .typora-export h3, .typora-export h4, .typora-export h5, .typora-export h6 { break-inside: avoid; }
}
.md-diagram-panel .messageText { stroke: none !important; }
.md-diagram-panel .start-state { fill: var(--node-fill); }
.md-diagram-panel .edgeLabel rect { opacity: 1 !important; }
.md-require-zoom-fix foreignobject { font-size: var(--mermaid-font-zoom); }


.CodeMirror { height: auto; }
.CodeMirror.cm-s-inner { background: inherit; }
.CodeMirror-scroll { overflow: auto hidden; z-index: 3; }
.CodeMirror-gutter-filler, .CodeMirror-scrollbar-filler { background-color: rgb(255, 255, 255); }
.CodeMirror-gutters { border-right: 1px solid rgb(221, 221, 221); background: inherit; white-space: nowrap; }
.CodeMirror-linenumber { padding: 0px 3px 0px 5px; text-align: right; color: rgb(153, 153, 153); }
.cm-s-inner .cm-keyword { color: rgb(119, 0, 136); }
.cm-s-inner .cm-atom, .cm-s-inner.cm-atom { color: rgb(34, 17, 153); }
.cm-s-inner .cm-number { color: rgb(17, 102, 68); }
.cm-s-inner .cm-def { color: rgb(0, 0, 255); }
.cm-s-inner .cm-variable { color: rgb(0, 0, 0); }
.cm-s-inner .cm-variable-2 { color: rgb(0, 85, 170); }
.cm-s-inner .cm-variable-3 { color: rgb(0, 136, 85); }
.cm-s-inner .cm-string { color: rgb(170, 17, 17); }
.cm-s-inner .cm-property { color: rgb(0, 0, 0); }
.cm-s-inner .cm-operator { color: rgb(152, 26, 26); }
.cm-s-inner .cm-comment, .cm-s-inner.cm-comment { color: rgb(170, 85, 0); }
.cm-s-inner .cm-string-2 { color: rgb(255, 85, 0); }
.cm-s-inner .cm-meta { color: rgb(85, 85, 85); }
.cm-s-inner .cm-qualifier { color: rgb(85, 85, 85); }
.cm-s-inner .cm-builtin { color: rgb(51, 0, 170); }
.cm-s-inner .cm-bracket { color: rgb(153, 153, 119); }
.cm-s-inner .cm-tag { color: rgb(17, 119, 0); }
.cm-s-inner .cm-attribute { color: rgb(0, 0, 204); }
.cm-s-inner .cm-header, .cm-s-inner.cm-header { color: rgb(0, 0, 255); }
.cm-s-inner .cm-quote, .cm-s-inner.cm-quote { color: rgb(0, 153, 0); }
.cm-s-inner .cm-hr, .cm-s-inner.cm-hr { color: rgb(153, 153, 153); }
.cm-s-inner .cm-link, .cm-s-inner.cm-link { color: rgb(0, 0, 204); }
.cm-negative { color: rgb(221, 68, 68); }
.cm-positive { color: rgb(34, 153, 34); }
.cm-header, .cm-strong { font-weight: 700; }
.cm-del { text-decoration: line-through; }
.cm-em { font-style: italic; }
.cm-link { text-decoration: underline; }
.cm-error { color: red; }
.cm-invalidchar { color: red; }
.cm-constant { color: rgb(38, 139, 210); }
.cm-defined { color: rgb(181, 137, 0); }
div.CodeMirror span.CodeMirror-matchingbracket { color: rgb(0, 255, 0); }
div.CodeMirror span.CodeMirror-nonmatchingbracket { color: rgb(255, 34, 34); }
.cm-s-inner .CodeMirror-activeline-background { background: inherit; }
.CodeMirror { position: relative; overflow: hidden; }
.CodeMirror-scroll { height: 100%; outline: 0px; position: relative; box-sizing: content-box; background: inherit; }
.CodeMirror-sizer { position: relative; }
.CodeMirror-gutter-filler, .CodeMirror-hscrollbar, .CodeMirror-scrollbar-filler, .CodeMirror-vscrollbar { position: absolute; z-index: 6; display: none; }
.CodeMirror-vscrollbar { right: 0px; top: 0px; overflow: hidden; }
.CodeMirror-hscrollbar { bottom: 0px; left: 0px; overflow: hidden; }
.CodeMirror-scrollbar-filler { right: 0px; bottom: 0px; }
.CodeMirror-gutter-filler { left: 0px; bottom: 0px; }
.CodeMirror-gutters { position: absolute; left: 0px; top: 0px; padding-bottom: 30px; z-index: 3; }
.CodeMirror-gutter { white-space: normal; height: 100%; box-sizing: content-box; padding-bottom: 30px; margin-bottom: -32px; display: inline-block; }
.CodeMirror-gutter-wrapper { position: absolute; z-index: 4; background: 0px 0px !important; border: none !important; }
.CodeMirror-gutter-background { position: absolute; top: 0px; bottom: 0px; z-index: 4; }
.CodeMirror-gutter-elt { position: absolute; cursor: default; z-index: 4; }
.CodeMirror-lines { cursor: text; }
.CodeMirror pre { border-radius: 0px; border-width: 0px; background: 0px 0px; font-family: inherit; font-size: inherit; margin: 0px; white-space: pre; overflow-wrap: normal; color: inherit; z-index: 2; position: relative; overflow: visible; }
.CodeMirror-wrap pre { overflow-wrap: break-word; white-space: pre-wrap; word-break: normal; }
.CodeMirror-code pre { border-right: 30px solid transparent; width: fit-content; }
.CodeMirror-wrap .CodeMirror-code pre { border-right: none; width: auto; }
.CodeMirror-linebackground { position: absolute; left: 0px; right: 0px; top: 0px; bottom: 0px; z-index: 0; }
.CodeMirror-linewidget { position: relative; z-index: 2; overflow: auto; }
.CodeMirror-wrap .CodeMirror-scroll { overflow-x: hidden; }
.CodeMirror-measure { position: absolute; width: 100%; height: 0px; overflow: hidden; visibility: hidden; }
.CodeMirror-measure pre { position: static; }
.CodeMirror div.CodeMirror-cursor { position: absolute; visibility: hidden; border-right: none; width: 0px; }
.CodeMirror div.CodeMirror-cursor { visibility: hidden; }
.CodeMirror-focused div.CodeMirror-cursor { visibility: inherit; }
.cm-searching { background: rgba(255, 255, 0, 0.4); }
@media print {
  .CodeMirror div.CodeMirror-cursor { visibility: hidden; }
}


html {
	font-size: 19px;
}

html, body {
	margin: auto;
	background: #fefefe;
}
body {
	font-family: "Vollkorn", Palatino, Times;
	color: #333;
	line-height: 1.4;
	text-align: justify;
}

#write {
	max-width: 960px;
	margin: 0 auto;
	margin-bottom: 2em;
	line-height: 1.53;
	padding-top: 40px;
}

@media only screen and (min-width: 1400px) {
	#write {
		max-width: 1100px;
	}
}

@media print {
	html {
		font-size: 13px;
	}
}

/* Typography
-------------------------------------------------------- */

#write>h1:first-child,
h1 {
	margin-top: 1.6em;
	font-weight: normal;
}

h1 {
	font-size:3em;
}

h2 {
	margin-top:2em;
	font-weight: normal;
}

h3 {
	font-weight: normal;
	font-style: italic;
	margin-top: 3em;
}

h1, 
h2, 
h3{
	text-align: center;
}

h2:after{
	border-bottom: 1px solid #2f2f2f;
    content: '';
    width: 100px;
    display: block;
    margin: 0 auto;
    height: 1px;
}

h1+h2, h2+h3 {
	margin-top: 0.83em;
}

p,
.mathjax-block {
	margin-top: 0;
	-webkit-hypens: auto;
	-moz-hypens: auto;
	hyphens: auto;
}
ul {
	list-style: square;
	padding-left: 1.2em;
}
ol {
	padding-left: 1.2em;
}
blockquote {
	margin-left: 1em;
	padding-left: 1em;
	border-left: 1px solid #ddd;
}
code,
pre {
	font-family: "Consolas", "Menlo", "Monaco", monospace, serif;
	font-size: .9em;
	background: white;
}
.md-fences{
	margin-left: 1em;
	padding-left: 1em;
	border: 1px solid #ddd;
	padding-bottom: 8px;
	padding-top: 6px;
	margin-bottom: 1.5em;
}

a {
	color: #2484c1;
	text-decoration: none;
}
a:hover {
	text-decoration: underline;
}
a img {
	border: none;
}
h1 a,
h1 a:hover {
	color: #333;
	text-decoration: none;
}
hr {
	color: #ddd;
	height: 1px;
	margin: 2em 0;
	border-top: solid 1px #ddd;
	border-bottom: none;
	border-left: 0;
	border-right: 0;
}
.ty-table-edit {
	background: #ededed;
    padding-top: 4px;
}
table {
	margin-bottom: 1.333333rem
}
table th,
table td {
	padding: 8px;
	line-height: 1.333333rem;
	vertical-align: top;
	border-top: 1px solid #ddd
}
table th {
	font-weight: bold
}
table thead th {
	vertical-align: bottom
}
table caption+thead tr:first-child th,
table caption+thead tr:first-child td,
table colgroup+thead tr:first-child th,
table colgroup+thead tr:first-child td,
table thead:first-child tr:first-child th,
table thead:first-child tr:first-child td {
	border-top: 0
}
table tbody+tbody {
	border-top: 2px solid #ddd
}

.task-list{
	padding:0;
}

.md-task-list-item {
	padding-left: 1.6rem;
}

.md-task-list-item > input:before {
	content: '\221A';
	display: inline-block;
	width: 1.33333333rem;
  	height: 1.6rem;
	vertical-align: middle;
	text-align: center;
	color: #ddd;
	background-color: #fefefe;
}

.md-task-list-item > input:checked:before,
.md-task-list-item > input[checked]:before{
	color: inherit;
}
.md-tag {
	color: inherit;
	font: inherit;
}
#write pre.md-meta-block {
	min-height: 35px;
	padding: 0.5em 1em;
}
#write pre.md-meta-block {
	white-space: pre;
	background: #f8f8f8;
	border: 0px;
	color: #999;
	
	width: 100vw;
	max-width: calc(100% + 60px);
	margin-left: -30px;
	border-left: 30px #f8f8f8 solid;
	border-right: 30px #f8f8f8 solid;

	margin-bottom: 2em;
	margin-top: -1.3333333333333rem;
	padding-top: 26px;
	padding-bottom: 10px;
	line-height: 1.8em;
	font-size: 0.9em;
	font-size: 0.76em;
	padding-left: 0;
}
.md-img-error.md-image>.md-meta{
	vertical-align: bottom;
}
#write>h5.md-focus:before {
	top: 2px;
}

.md-toc {
	margin-top: 40px;
}

.md-toc-content {
	padding-bottom: 20px;
}

.outline-expander:before {
	color: inherit;
	font-size: 14px;
	top: auto;
	content: "\f0da";
	font-family: FontAwesome;
}

.outline-expander:hover:before,
.outline-item-open>.outline-item>.outline-expander:before {
  	content: "\f0d7";
}

/** source code mode */
#typora-source {
	font-family: Courier, monospace;
    color: #6A6A6A;
}

.html-for-mac #typora-sidebar {
    -webkit-box-shadow: 0 6px 12px rgba(0, 0, 0, .175);
    box-shadow: 0 6px 12px rgba(0, 0, 0, .175);
}

.cm-s-typora-default .cm-header, 
.cm-s-typora-default .cm-property,
.CodeMirror.cm-s-typora-default div.CodeMirror-cursor {
	color: #428bca;
}

.cm-s-typora-default .cm-atom, .cm-s-typora-default .cm-number {
	color: #777777;
}

.typora-node .file-list-item-parent-loc, 
.typora-node .file-list-item-time, 
.typora-node .file-list-item-summary {
	font-family: arial, sans-serif;
}

.md-task-list-item>input {
    margin-left: -1.3em;
    margin-top: calc(1rem - 12px);
}

.md-mathjax-midline {
	background: #fafafa;
}

.md-fences .code-tooltip {
	bottom: -2em !important;
}

.dropdown-menu .divider {
	border-color: #e5e5e5;
}

 :root {--mermaid-font-zoom:0.833333em ;} 
</style>
</head>
<body class='typora-export os-windows'>
<div id='write'  class=''><h1><a name="elk日志分析平台" class="md-header-anchor"></a><span>ELK日志分析平台</span></h1><div class='md-toc' mdtype='toc'><p class="md-toc-content" role="list"><span role="listitem" class="md-toc-item md-toc-h1" data-ref="n0"><a class="md-toc-inner" href="#elk日志分析平台">ELK日志分析平台</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n3"><a class="md-toc-inner" href="#kibana测试使用">Kibana测试使用</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n27"><a class="md-toc-inner" href="#elk架构图例">ELK架构图例</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n29"><a class="md-toc-inner" href="#logstash安装">logstash安装</a></span><span role="listitem" class="md-toc-item md-toc-h3" data-ref="n30"><a class="md-toc-inner" href="#购买云主机">购买云主机 </a></span><span role="listitem" class="md-toc-item md-toc-h3" data-ref="n40"><a class="md-toc-inner" href="#安装logstash">安装logstash</a></span><span role="listitem" class="md-toc-item md-toc-h3" data-ref="n42"><a class="md-toc-inner" href="#基础配置样例">基础配置样例</a></span><span role="listitem" class="md-toc-item md-toc-h3" data-ref="n44"><a class="md-toc-inner" href="#插件与调试格式">插件与调试格式</a></span><span role="listitem" class="md-toc-item md-toc-h4" data-ref="n47"><a class="md-toc-inner" href="#input-file插件从文件中读取数据">input file插件：从文件中读取数据</a></span><span role="listitem" class="md-toc-item md-toc-h4" data-ref="n56"><a class="md-toc-inner" href="#filter-grok插件">filter grok插件</a></span><span role="listitem" class="md-toc-item md-toc-h4" data-ref="n60"><a class="md-toc-inner" href="#output-elasticsearch插件">output elasticsearch插件</a></span><span role="listitem" class="md-toc-item md-toc-h1" data-ref="n64"><a class="md-toc-inner" href="#web日志分析实战">WEB日志分析实战</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n65"><a class="md-toc-inner" href="#beats配置">beats配置</a></span><span role="listitem" class="md-toc-item md-toc-h2" data-ref="n67"><a class="md-toc-inner" href="#filebeat安装配置">filebeat安装配置</a></span><span role="listitem" class="md-toc-item md-toc-h3" data-ref="n73"><a class="md-toc-inner" href="#logstash额外配置">logstash额外配置</a></span><span role="listitem" class="md-toc-item md-toc-h1" data-ref="n96"><a class="md-toc-inner" href="#补充">补充</a></span></p></div><h2><a name="kibana测试使用" class="md-header-anchor"></a><span>Kibana测试使用</span></h2><p><span>浏览器访问kibana：负载均衡IP:5601</span></p><p><img src="cloud_01.assets/image-20230607005606908.png" referrerpolicy="no-referrer" alt="image-20230607005606908"></p><p><span>选择 自己浏览 ，配置数据</span></p><p><span>在kibana中指定索引，绘制图表</span></p><p><img src="cloud_01.assets/image-20230608002407818.png" referrerpolicy="no-referrer" alt="image-20230608002407818"></p><p><img src="cloud_01.assets/image-20230608002737056.png" referrerpolicy="no-referrer" alt="image-20230608002737056"></p><p><img src="cloud_01.assets/image-20230608005331766.png" referrerpolicy="no-referrer" alt="image-20230608005331766"></p><p><span>已经可以看到数据</span></p><p><img src="cloud_01.assets/image-20230608005400858.png" referrerpolicy="no-referrer" alt="image-20230608005400858"></p><p><span>也可以自己做其他的图表数据</span></p><p><img src="cloud_01.assets/image-20230608005442730.png" referrerpolicy="no-referrer" alt="image-20230608005442730"></p><p><img src="cloud_01.assets/image-20230608005456845.png" referrerpolicy="no-referrer" alt="image-20230608005456845"></p><p><img src="cloud_01.assets/image-20230608005508959.png" referrerpolicy="no-referrer" alt="image-20230608005508959"></p><p><img src="cloud_01.assets/image-20230608005525945.png" referrerpolicy="no-referrer" alt="image-20230608005525945"></p><p>&nbsp;</p><p><span>选择 词，即在日志中记录的字段；选择具体字段，如geo.src.keyword(用户的来源地)</span></p><p><img src="cloud_01.assets/image-20230608005603977.png" referrerpolicy="no-referrer" alt="image-20230608005603977"></p><p><span>也可以禁用</span></p><p><img src="cloud_01.assets/image-20230608005715738.png" referrerpolicy="no-referrer" alt="image-20230608005715738"></p><p><span>选择machine.os.keyword(操作系统）</span></p><p><img src="cloud_01.assets/image-20230608005737380.png" referrerpolicy="no-referrer" alt="image-20230608005737380"></p><p><img src="cloud_01.assets/image-20230608005816995.png" referrerpolicy="no-referrer" alt="image-20230608005816995"></p><p><span>也可以选择agent.keyword(浏览器)，自行做实验</span></p><h2><a name="elk架构图例" class="md-header-anchor"></a><span>ELK架构图例</span></h2><div class="md-diagram-panel"><svg id="mermaidChart0" width="100%" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" height="504.66748046875" style="max-width: 985.336px; height: 544.667px;" viewBox="0 0 985.3359375 504.66748046875" class="md-require-zoom-fix"><style>#mermaidChart0{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:22.800000543594372px;fill:#333333;}#mermaidChart0 .error-icon{fill:hsl(60,100%,100%);}#mermaidChart0 .error-text{fill:rgb(0,0,0);stroke:rgb(0,0,0);}#mermaidChart0 .edge-thickness-normal{stroke-width:2px;}#mermaidChart0 .edge-thickness-thick{stroke-width:3.5px;}#mermaidChart0 .edge-pattern-solid{stroke-dasharray:0;}#mermaidChart0 .edge-pattern-dashed{stroke-dasharray:3;}#mermaidChart0 .edge-pattern-dotted{stroke-dasharray:2;}#mermaidChart0 .marker{fill:#000000;}#mermaidChart0 .marker.cross{stroke:#000000;}#mermaidChart0 svg{font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:22.800000543594372px;}#mermaidChart0 .label{font-family:"trebuchet ms",verdana,arial,sans-serif;color:#333;}#mermaidChart0 .label text{fill:#333;}#mermaidChart0 .node rect,#mermaidChart0 .node circle,#mermaidChart0 .node ellipse,#mermaidChart0 .node polygon,#mermaidChart0 .node path{fill:#ECECFF;stroke:hsl(240,60%,86.2745098039%);stroke-width:1px;}#mermaidChart0 .node .label{text-align:center;}#mermaidChart0 .node.clickable{cursor:pointer;}#mermaidChart0 .arrowheadPath{fill:undefined;}#mermaidChart0 .edgePath .path{stroke:#000000;stroke-width:1.5px;}#mermaidChart0 .flowchart-link{stroke:#000000;fill:none;}#mermaidChart0 .edgeLabel{background-color:#f4f4f4;text-align:center;}#mermaidChart0 .edgeLabel rect{opacity:0.5;background-color:#f4f4f4;fill:#f4f4f4;}#mermaidChart0 .cluster rect{fill:hsl(60,100%,100%);stroke:hsl(60,60%,90%);stroke-width:1px;}#mermaidChart0 .cluster text{fill:rgb(0,0,0);}#mermaidChart0 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:"trebuchet ms",verdana,arial,sans-serif;font-size:12px;background:hsl(60,100%,100%);border:1px solid undefined;border-radius:2px;pointer-events:none;z-index:100;}#mermaidChart0:root{--mermaid-font-family:sans-serif;}#mermaidChart0:root{--mermaid-alt-font-family:sans-serif;}#mermaidChart0 .APP &gt; *{color:#0000ff !important;fill:#99ff99 !important;}#mermaidChart0 .APP tspan{fill:#0000ff !important;}#mermaidChart0 .ZONE &gt; *{fill:#ffffc0 !important;color:#ff00ff !important;}#mermaidChart0 .ZONE tspan{fill:#ff00ff !important;}#mermaidChart0 flowchart-v2{fill:apa;}</style><g transform="translate(0, 2)"><marker id="flowchart-pointEnd" class="marker flowchart" viewBox="0 0 10 10" refX="9" refY="5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 0 0 L 10 5 L 0 10 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="flowchart-pointStart" class="marker flowchart" viewBox="0 0 10 10" refX="0" refY="5" markerUnits="userSpaceOnUse" markerWidth="12" markerHeight="12" orient="auto"><path d="M 0 5 L 10 10 L 10 0 z" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></path></marker><marker id="flowchart-circleEnd" class="marker flowchart" viewBox="0 0 10 10" refX="11" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="flowchart-circleStart" class="marker flowchart" viewBox="0 0 10 10" refX="-1" refY="5" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><circle cx="5" cy="5" r="5" class="arrowMarkerPath" style="stroke-width: 1; stroke-dasharray: 1, 0;"></circle></marker><marker id="flowchart-crossEnd" class="marker cross flowchart" viewBox="0 0 11 11" refX="12" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><marker id="flowchart-crossStart" class="marker cross flowchart" viewBox="0 0 11 11" refX="-1" refY="5.2" markerUnits="userSpaceOnUse" markerWidth="11" markerHeight="11" orient="auto"><path d="M 1,1 l 9,9 M 10,1 l -9,9" class="arrowMarkerPath" style="stroke-width: 2; stroke-dasharray: 1, 0;"></path></marker><g class="root"><g class="clusters"><g class="cluster ZONE" id="Z3"><rect rx="0" ry="0" x="726.5026168823242" y="8" width="129.89581298828125" height="486.6674613952637"></rect><g class="cluster-label" transform="translate(735.9362106323242, 6)"><foreignObject width="111.02862548828125" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>Elasticsearch</span></div></foreignObject></g></g><g class="cluster ZONE" id="Z2"><rect rx="0" ry="0" x="337.24486541748047" y="24.666746139526367" width="339.25775146484375" height="433.33396911621094"></rect><g class="cluster-label" transform="translate(470.55213165283203, 22.666746139526367)"><foreignObject width="72.64321899414062" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>Logstash</span></div></foreignObject></g></g><g class="cluster ZONE" id="Z1"><rect rx="0" ry="0" x="8" y="101.33349227905273" width="279.24486541748047" height="300.0004768371582"></rect><g class="cluster-label" transform="translate(98.03258895874023, 99.33349227905273)"><foreignObject width="99.1796875" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>web cluster</span></div></foreignObject></g></g></g><g class="edgePaths"><path d="M119.5364990234375,158.0002384185791L123.70316569010417,158.0002384185791C127.86983235677083,158.0002384185791,136.20316569010416,158.0002384185791,144.5364990234375,158.0002384185791C152.86983235677084,158.0002384185791,161.20316569010416,158.0002384185791,165.36983235677084,158.0002384185791L169.5364990234375,158.0002384185791" id="L-H1-F1" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-H1 LE-F1" style="fill:none;" marker-start="url(#flowchart-circleStart)" marker-end="url(#flowchart-circleEnd)"></path><path d="M119.5364990234375,251.33373069763184L123.70316569010417,251.33373069763184C127.86983235677083,251.33373069763184,136.20316569010416,251.33373069763184,144.5364990234375,251.33373069763184C152.86983235677084,251.33373069763184,161.20316569010416,251.33373069763184,165.36983235677084,251.33373069763184L169.5364990234375,251.33373069763184" id="L-H2-F2" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-H2 LE-F2" style="fill:none;" marker-start="url(#flowchart-circleStart)" marker-end="url(#flowchart-circleEnd)"></path><path d="M119.5364990234375,344.66722297668457L123.70316569010417,344.66722297668457C127.86983235677083,344.66722297668457,136.20316569010416,344.66722297668457,144.5364990234375,344.66722297668457C152.86983235677084,344.66722297668457,161.20316569010416,344.66722297668457,165.36983235677084,344.66722297668457L169.5364990234375,344.66722297668457" id="L-H3-F3" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-H3 LE-F3" style="fill:none;" marker-start="url(#flowchart-circleStart)" marker-end="url(#flowchart-circleEnd)"></path><path d="M262.24486541748047,158.0002384185791L266.41153208414715,158.0002384185791C270.5781987508138,158.0002384185791,278.91153208414715,158.0002384185791,287.24486541748047,158.0002384185791C295.5781987508138,158.0002384185791,303.91153208414715,158.0002384185791,312.24486541748047,158.0002384185791C320.5781987508138,158.0002384185791,328.91153208414715,158.0002384185791,339.68980765334715,169.29079283006715C350.46808322254714,180.58134724155516,363.69130102761375,203.16245606453128,370.3029099301471,214.45301047601933L376.91451883268047,225.74356488750738" id="L-F1-A1" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-F1 LE-A1" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M262.24486541748047,251.33373069763184L266.41153208414715,251.33373069763184C270.5781987508138,251.33373069763184,278.91153208414715,251.33373069763184,287.24486541748047,251.33373069763184C295.5781987508138,251.33373069763184,303.91153208414715,251.33373069763184,312.24486541748047,251.33373069763184C320.5781987508138,251.33373069763184,328.91153208414715,251.33373069763184,337.24486541748047,251.33373069763184C345.5781987508138,251.33373069763184,353.91153208414715,251.33373069763184,358.0781987508138,251.33373069763184L362.24486541748047,251.33373069763184" id="L-F2-A1" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-F2 LE-A1" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M262.24486541748047,344.66722297668457L266.41153208414715,344.66722297668457C270.5781987508138,344.66722297668457,278.91153208414715,344.66722297668457,287.24486541748047,344.66722297668457C295.5781987508138,344.66722297668457,303.91153208414715,344.66722297668457,312.24486541748047,344.66722297668457C320.5781987508138,344.66722297668457,328.91153208414715,344.66722297668457,339.68980765334715,333.37666856519655C350.46808322254714,322.0861141537085,363.69130102761375,299.5050053307324,370.3029099301471,288.21445091924437L376.91451883268047,276.9238965077563" id="L-F3-A1" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-F3 LE-A1" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M421.5547409057617,251.33373069763184L425.7214075724284,251.33373069763184C429.88807423909503,251.33373069763184,438.2214075724284,251.33373069763184,446.5547409057617,251.33373069763184C454.88807423909503,251.33373069763184,463.2214075724284,251.33373069763184,467.38807423909503,251.33373069763184L471.5547409057617,251.33373069763184" id="L-A1-A2" class=" edge-thickness-thick edge-pattern-solid flowchart-link LS-A1 LE-A2" style="stroke-width: 3.5px;fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M529.888053894043,251.33373069763184L534.0547205607096,251.33373069763184C538.2213872273763,251.33373069763184,546.5547205607096,251.33373069763184,554.888053894043,251.33373069763184C563.2213872273763,251.33373069763184,571.5547205607096,251.33373069763184,575.7213872273763,251.33373069763184L579.888053894043,251.33373069763184" id="L-A2-A3" class=" edge-thickness-thick edge-pattern-solid flowchart-link LS-A2 LE-A3" style="stroke-width: 3.5px;fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M626.7860445211089,217.28732737908035L635.0721399146448,191.8505638391547C643.3582353081807,166.41380029922902,659.9304260952525,115.5402732193777,672.3831881554551,90.10350967945203C684.8359502156576,64.66674613952637,693.1692835489908,64.66674613952637,701.5026168823242,64.66674613952637C709.8359502156576,64.66674613952637,718.1692835489908,64.66674613952637,726.5026168823242,64.66674613952637C734.8359502156576,64.66674613952637,743.1692835489908,64.66674613952637,747.3359502156576,64.66674613952637L751.5026168823242,64.66674613952637" id="L-A3-ES1" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-A3 LE-ES1" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M635.2416275612238,221.331999576132L642.1184591147406,210.77670604987318C648.9952906682573,200.2214125236144,662.7489537752907,179.11082547109675,673.7924519954742,168.55553194483792C684.8359502156576,158.0002384185791,693.1692835489908,158.0002384185791,701.5026168823242,158.0002384185791C709.8359502156576,158.0002384185791,718.1692835489908,158.0002384185791,726.5026168823242,158.0002384185791C734.8359502156576,158.0002384185791,743.1692835489908,158.0002384185791,747.3359502156576,158.0002384185791L751.5026168823242,158.0002384185791" id="L-A3-ES2" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-A3 LE-ES2" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M651.5026168823242,251.33373069763184L655.6692835489908,251.33373069763184C659.8359502156576,251.33373069763184,668.1692835489908,251.33373069763184,676.5026168823242,251.33373069763184C684.8359502156576,251.33373069763184,693.1692835489908,251.33373069763184,701.5026168823242,251.33373069763184C709.8359502156576,251.33373069763184,718.1692835489908,251.33373069763184,726.5026168823242,251.33373069763184C734.8359502156576,251.33373069763184,743.1692835489908,251.33373069763184,747.3359502156576,251.33373069763184L751.5026168823242,251.33373069763184" id="L-A3-ES3" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-A3 LE-ES3" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M635.2416275612238,281.3354618191317L642.1184591147406,291.8907553453905C648.9952906682573,302.44604887164934,662.7489537752907,323.556635924167,673.7924519954742,334.11192945042575C684.8359502156576,344.66722297668457,693.1692835489908,344.66722297668457,701.5026168823242,344.66722297668457C709.8359502156576,344.66722297668457,718.1692835489908,344.66722297668457,726.5026168823242,344.66722297668457C734.8359502156576,344.66722297668457,743.1692835489908,344.66722297668457,747.3359502156576,344.66722297668457L751.5026168823242,344.66722297668457" id="L-A3-ES4" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-A3 LE-ES4" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M626.7860445211089,285.3801340161833L635.0721399146448,310.816897556109C643.3582353081807,336.25366109603465,659.9304260952525,387.127188175886,672.3831881554551,412.5639517158117C684.8359502156576,438.0007152557373,693.1692835489908,438.0007152557373,701.5026168823242,438.0007152557373C709.8359502156576,438.0007152557373,718.1692835489908,438.0007152557373,726.5026168823242,438.0007152557373C734.8359502156576,438.0007152557373,743.1692835489908,438.0007152557373,747.3359502156576,438.0007152557373L751.5026168823242,438.0007152557373" id="L-A3-ES5" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-A3 LE-ES5" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M831.3984298706055,64.66674613952637L835.5650965372721,64.66674613952637C839.7317632039388,64.66674613952637,848.0650965372721,64.66674613952637,856.3984298706055,64.66674613952637C864.7317632039388,64.66674613952637,873.0650965372721,64.66674613952637,885.4071071755847,89.98430871903822C897.7491178138972,115.30187129855011,914.0998057571891,165.93699645757385,922.2751497288349,191.25455903708573L930.4504937004807,216.5721216165976" id="L-ES1-K" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-ES1 LE-K" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M831.3984298706055,158.0002384185791L835.5650965372721,158.0002384185791C839.7317632039388,158.0002384185791,848.0650965372721,158.0002384185791,856.3984298706055,158.0002384185791C864.7317632039388,158.0002384185791,873.0650965372721,158.0002384185791,883.5043261472306,168.03609306692877C893.9435557571891,178.07194771527847,906.4886816437726,198.1436570119778,912.7612445870644,208.1795116603275L919.0338075303561,218.2153663086772" id="L-ES2-K" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-ES2 LE-K" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M831.3984298706055,251.33373069763184L835.5650965372721,251.33373069763184C839.7317632039388,251.33373069763184,848.0650965372721,251.33373069763184,856.3984298706055,251.33373069763184C864.7317632039388,251.33373069763184,873.0650965372721,251.33373069763184,881.3984298706055,251.33373069763184C889.7317632039388,251.33373069763184,898.0650965372721,251.33373069763184,902.2317632039388,251.33373069763184L906.3984298706055,251.33373069763184" id="L-ES3-K" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-ES3 LE-K" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M831.3984298706055,344.66722297668457L835.5650965372721,344.66722297668457C839.7317632039388,344.66722297668457,848.0650965372721,344.66722297668457,856.3984298706055,344.66722297668457C864.7317632039388,344.66722297668457,873.0650965372721,344.66722297668457,883.5043261472306,334.6313683283349C893.9435557571891,324.59551367998523,906.4886816437726,304.52380438328584,912.7612445870644,294.4879497349362L919.0338075303561,284.4520950865865" id="L-ES4-K" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-ES4 LE-K" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path><path d="M831.3984298706055,438.0007152557373L835.5650965372721,438.0007152557373C839.7317632039388,438.0007152557373,848.0650965372721,438.0007152557373,856.3984298706055,438.0007152557373C864.7317632039388,438.0007152557373,873.0650965372721,438.0007152557373,885.4071071755847,412.68315267622546C897.7491178138972,387.36559009671356,914.0998057571891,336.7304649376898,922.2751497288349,311.412902358178L930.4504937004807,286.0953397786661" id="L-ES5-K" class=" edge-thickness-normal edge-pattern-solid flowchart-link LS-ES5 LE-K" style="fill:none;" marker-end="url(#flowchart-pointEnd)"></path></g><g class="edgeLabels"><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g><g class="edgeLabel"><g class="label" transform="translate(0, 0)"><foreignObject width="0" height="0"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span></span></div></foreignObject></g></g></g><g class="nodes"><g class="node default APP" id="flowchart-ES1-36" transform="translate(791.4505233764648, 64.66674613952637)"><rect class="basic label-container" style="" rx="5" ry="5" x="-39.947906494140625" y="-21.666748046875" width="79.89581298828125" height="43.33349609375"></rect><g class="label" style="" transform="translate(-32.447906494140625, -14.166748046875)"><foreignObject width="64.89581298828125" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>es-0001</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-ES2-37" transform="translate(791.4505233764648, 158.0002384185791)"><rect class="basic label-container" style="" rx="5" ry="5" x="-39.947906494140625" y="-21.666748046875" width="79.89581298828125" height="43.33349609375"></rect><g class="label" style="" transform="translate(-32.447906494140625, -14.166748046875)"><foreignObject width="64.89581298828125" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>es-0002</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-ES3-38" transform="translate(791.4505233764648, 251.33373069763184)"><rect class="basic label-container" style="" rx="5" ry="5" x="-39.947906494140625" y="-21.666748046875" width="79.89581298828125" height="43.33349609375"></rect><g class="label" style="" transform="translate(-32.447906494140625, -14.166748046875)"><foreignObject width="64.89581298828125" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>es-0003</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-ES4-39" transform="translate(791.4505233764648, 344.66722297668457)"><rect class="basic label-container" style="" rx="5" ry="5" x="-39.947906494140625" y="-21.666748046875" width="79.89581298828125" height="43.33349609375"></rect><g class="label" style="" transform="translate(-32.447906494140625, -14.166748046875)"><foreignObject width="64.89581298828125" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>es-0004</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-ES5-40" transform="translate(791.4505233764648, 438.0007152557373)"><rect class="basic label-container" style="" rx="5" ry="5" x="-39.947906494140625" y="-21.666748046875" width="79.89581298828125" height="43.33349609375"></rect><g class="label" style="" transform="translate(-32.447906494140625, -14.166748046875)"><foreignObject width="64.89581298828125" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>es-0005</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-A3-35" transform="translate(615.6953353881836, 251.33373069763184)"><circle rx="0" ry="0" r="35.807281494140625" width="71.61456298828125" height="43.33349609375"></circle><g class="label" style="" transform="translate(-28.307281494140625, -14.166748046875)"><foreignObject width="56.61456298828125" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>output</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-A2-34" transform="translate(500.72139739990234, 251.33373069763184)"><circle rx="0" ry="0" r="29.166656494140625" width="58.33331298828125" height="43.33349609375"></circle><g class="label" style="" transform="translate(-21.666656494140625, -14.166748046875)"><foreignObject width="43.33331298828125" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>filter</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-A1-33" transform="translate(391.8998031616211, 251.33373069763184)"><circle rx="0" ry="0" r="29.654937744140625" width="59.30987548828125" height="43.33349609375"></circle><g class="label" style="" transform="translate(-22.154937744140625, -14.166748046875)"><foreignObject width="44.30987548828125" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>input</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-F1-25" transform="translate(215.89068222045898, 158.0002384185791)"><rect rx="21.666748046875" ry="21.666748046875" x="-46.35418701171875" y="-21.666748046875" width="92.7083740234375" height="43.33349609375"></rect><g class="label" style="" transform="translate(-33.4375, -14.166748046875)"><foreignObject width="66.875" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>filebeat</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-H1-24" transform="translate(76.26824951171875, 158.0002384185791)"><rect rx="21.666748046875" ry="21.666748046875" x="-43.26824951171875" y="-21.666748046875" width="86.5364990234375" height="43.33349609375"></rect><g class="label" style="" transform="translate(-30.3515625, -14.166748046875)"><foreignObject width="60.703125" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>apache</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-F2-27" transform="translate(215.89068222045898, 251.33373069763184)"><rect rx="21.666748046875" ry="21.666748046875" x="-46.35418701171875" y="-21.666748046875" width="92.7083740234375" height="43.33349609375"></rect><g class="label" style="" transform="translate(-33.4375, -14.166748046875)"><foreignObject width="66.875" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>filebeat</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-H2-26" transform="translate(76.26824951171875, 251.33373069763184)"><rect rx="21.666748046875" ry="21.666748046875" x="-43.26824951171875" y="-21.666748046875" width="86.5364990234375" height="43.33349609375"></rect><g class="label" style="" transform="translate(-30.3515625, -14.166748046875)"><foreignObject width="60.703125" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>apache</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-F3-29" transform="translate(215.89068222045898, 344.66722297668457)"><rect rx="21.666748046875" ry="21.666748046875" x="-46.35418701171875" y="-21.666748046875" width="92.7083740234375" height="43.33349609375"></rect><g class="label" style="" transform="translate(-33.4375, -14.166748046875)"><foreignObject width="66.875" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>filebeat</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-H3-28" transform="translate(76.26824951171875, 344.66722297668457)"><rect rx="21.666748046875" ry="21.666748046875" x="-43.26824951171875" y="-21.666748046875" width="86.5364990234375" height="43.33349609375"></rect><g class="label" style="" transform="translate(-30.3515625, -14.166748046875)"><foreignObject width="60.703125" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>apache</span></div></foreignObject></g></g><g class="node default APP" id="flowchart-K-47" label-offset-y="9.05103668261563" transform="translate(941.8671798706055, 251.33373069763184)"><path d="M 0,9.05103668261563 a 35.46875,9.05103668261563 0,0,0 70.9375 0 a 35.46875,9.05103668261563 0,0,0 -70.9375 0 l 0,52.38453277636563 a 35.46875,9.05103668261563 0,0,0 70.9375 0 l 0,-52.38453277636563" transform="translate(-35.46875,-35.24330307079845)"></path><g class="label" style="" transform="translate(-27.96875, -14.166748046875)"><foreignObject width="55.9375" height="28.33349609375"><div xmlns="http://www.w3.org/1999/xhtml" style="display: inline-block; white-space: nowrap;"><span>kibana</span></div></foreignObject></g></g></g></g></g></svg></div><h2><a name="logstash安装" class="md-header-anchor"></a><span>logstash安装</span></h2><h3><a name="购买云主机" class="md-header-anchor"></a><span>购买云主机 </span></h3><figure><table><thead><tr><th><span>主机</span></th><th><span>IP地址</span></th><th><span>配置</span></th></tr></thead><tbody><tr><td><span>logstash</span></td><td><span>192.168.1.27</span></td><td><span>最低配置4核8G</span></td></tr></tbody></table></figure><h3><a name="安装logstash" class="md-header-anchor"></a><span>安装logstash</span></h3><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="shell"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="shell"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 3.60001px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@ecs-proxy ~]<span class="cm-comment"># ssh 192.168.1.27</span></span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/hosts</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">192</span>.168.1.21<span class="cm-tab" role="presentation" cm-text="	">    </span>es-0001</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">192</span>.168.1.22<span class="cm-tab" role="presentation" cm-text="	">    </span>es-0002</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">192</span>.168.1.23<span class="cm-tab" role="presentation" cm-text="	">    </span>es-0003</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">192</span>.168.1.24<span class="cm-tab" role="presentation" cm-text="	">    </span>es-0004</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">192</span>.168.1.25<span class="cm-tab" role="presentation" cm-text="	">    </span>es-0005</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">192</span>.168.1.27<span class="cm-tab" role="presentation" cm-text="	">    </span>logstash</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># yum install -y java-1.8.0-openjdk-devel logstash</span></span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 234px;"></div><div class="CodeMirror-gutters" style="display: none; height: 234px;"></div></div></div></pre><h3><a name="基础配置样例" class="md-header-anchor"></a><span>基础配置样例</span></h3><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="shell" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="shell"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 3.60001px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><span><span>​</span>x</span></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># ln -s /etc/logstash /usr/share/logstash/config<span class="cm-tab" role="presentation" cm-text="	">   </span># #logstash安装时配置在 /usr/share/logstash/，但是红帽安装时配置放到了/etc/，需要做个软连接到/usr/share/logstash/config，不然logstash找不到配置文件</span></span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">logstash 配置文件编写，stdin{} 和 stdout{} 都是logstash的插件；，logstash 的管理都是基于插件来完成的；</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">编写logstash的配置文件</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-comment">#stdin {} &nbsp; 为标准输入，即键盘和鼠标</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-comment">#stdout {}  为标准输出，即显示器</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/logstash/conf.d/my.conf<span class="cm-tab" role="presentation" cm-text="	"> </span><span class="cm-tab" role="presentation" cm-text="	">    </span>#配置文件以.conf结尾</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">input { </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  stdin {}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">filter{ }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">output{ </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  stdout{}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">afsddddddddddd<span class="cm-tab" role="presentation" cm-text="	">  </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-comment">#输入普通字符串</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/awesome_print-1.7.0/lib/awesome_print/formatters/base_formatter.rb:31: warning: constant ::Fixnum is deprecated</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp;<span class="cm-string">"@version"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"1"</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp;<span class="cm-string">"@timestamp"</span> <span class="cm-operator">=</span>&gt; <span class="cm-number">2023</span><span class="cm-attribute">-06-07T17</span>:30:24.178Z,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; <span class="cm-string">"message"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"afsddddddddddd"</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-string">"host"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"logstash"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">{<span class="cm-string">"a"</span>:<span class="cm-string">"1"</span>, <span class="cm-string">"b"</span>:<span class="cm-string">"2"</span>, <span class="cm-string">"c"</span>:<span class="cm-string">"3"</span>}<span class="cm-tab" role="presentation" cm-text="	"> </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-comment">#输入json格式的数据，解析失败</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp;<span class="cm-string">"@version"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"1"</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp;<span class="cm-string">"@timestamp"</span> <span class="cm-operator">=</span>&gt; <span class="cm-number">2023</span><span class="cm-attribute">-06-07T17</span>:30:31.678Z,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; <span class="cm-string">"message"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"{\"a\":\"1\", \"b\":\"2\", \"c\":\"3\"}"</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-string">"host"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"logstash"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">直接ctrl <span class="cm-operator">+</span> C 退出</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">使用插件</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;<span class="cm-attribute">-</span> [x] 上面的配置文件使用了  logstash-input-stdin  和 logstash-output-stdout 两个插件，logstash 对数据的处理依赖插件</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">插件管理</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">查看logstash插件的使用命令</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash-plugin --help</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">列出logstash的所有插件，logstash的插件由三部分组成,以 <span class="cm-attribute">-</span> 进行分隔：</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash-plugin list</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-comment">#第一部分：代表logstash的插件；</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-comment">#第二部分：表示该插件只能用于logstash的哪一部分:</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp;  例如：</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-comment">#-input- 则只能用于读取数据；</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-comment">#-output- 只能用于输入数据到某个设备或文件；</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-comment">#-filter- 用于对数据进行分析和处理； </span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-comment">#-codec-  为编码插件，可以用于任何的区域【input,output或filter】；</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-comment">#第三部分：表示该插件具体的作用；</span></span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 1441px;"></div><div class="CodeMirror-gutters" style="display: none; height: 1441px;"></div></div></div></pre><h3><a name="插件与调试格式" class="md-header-anchor"></a><span>插件与调试格式</span></h3><p><span>使用json格式字符串测试  {&quot;a&quot;:&quot;1&quot;, &quot;b&quot;:&quot;2&quot;, &quot;c&quot;:&quot;3&quot;}</span></p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="shell" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="shell"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 3.60001px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">使用编码类插件，rubydebug调试格式时，以易读的格式显示</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">stdin { codec <span class="cm-operator">=</span>&gt; <span class="cm-string">"json"</span> } : 输入json格式的数据</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">stdout{ codec <span class="cm-operator">=</span>&gt; <span class="cm-string">"rubydebug"</span> } ： 数据输出以易读的格式显示</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/logstash/conf.d/my.conf</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">input { </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  stdin { codec <span class="cm-operator">=</span>&gt; <span class="cm-string">"json"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">filter{ }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">output{ </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  stdout{ codec <span class="cm-operator">=</span>&gt; <span class="cm-string">"rubydebug"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">{<span class="cm-string">"a"</span>:<span class="cm-string">"1"</span>, <span class="cm-string">"b"</span>:<span class="cm-string">"2"</span>, <span class="cm-string">"c"</span>:<span class="cm-string">"3"</span>}<span class="cm-tab" role="presentation" cm-text="	"> </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-comment">#输入json格式的数据,解析成功</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/awesome_print-1.7.0/lib/awesome_print/formatters/base_formatter.rb:31: warning: constant ::Fixnum is deprecated</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp;<span class="cm-string">"@version"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"1"</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp;<span class="cm-string">"@timestamp"</span> <span class="cm-operator">=</span>&gt; <span class="cm-number">2023</span><span class="cm-attribute">-06-07T15</span>:42:42.603Z,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"b"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"2"</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"c"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"3"</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-string">"host"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"logstash"</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"a"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"1"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 656px;"></div><div class="CodeMirror-gutters" style="display: none; height: 656px;"></div></div></div></pre><h4><a name="input-file插件从文件中读取数据" class="md-header-anchor"></a><span>input file插件：从文件中读取数据</span></h4><p><span>官方手册地址：</span><a href='https://www.elastic.co/guide/en/logstash/current/index.html' target='_blank' class='url'>https://www.elastic.co/guide/en/logstash/current/index.html</a></p><p><span>找6.8版本的logstash，或者相近版本的</span></p><p><img src="cloud_01.assets/image-20230608015241492.png" referrerpolicy="no-referrer" alt="image-20230608015241492"></p><p><img src="cloud_01.assets/image-20230608015342605.png" referrerpolicy="no-referrer" alt="image-20230608015342605"></p><p><span>找到案例，可以直接复制</span></p><p><img src="cloud_01.assets/image-20230608015524723.png" referrerpolicy="no-referrer" alt="image-20230608015524723"></p><p>&nbsp;</p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded md-focus" lang="shell" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap CodeMirror-focused" lang="shell"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 2551.2px; left: 709.2px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre>x</pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="" style="position: relative;"><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">定义input区域，将查找到的file插件代码，写入到input区域中</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">在file的帮助文档中查找，file插件中 input 区域的配置</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">setting &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#指的是key【键】，定义时名字必须相同；</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">input type &nbsp; &nbsp; &nbsp;<span class="cm-comment">#value【值】的数据类型；</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">Required &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-comment">#如果为yes,则为使用file插件的必须设置的键值；如果为no，则可有可无；</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">file插件的帮助文档中，找到一个必须配置path，要写入到配置文件中</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">定义file 插件的必须配置，path 指的是文件读取的路径，数组类型，可以同时读取多个文件的数据</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/logstash/conf.d/my.conf</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">input{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  stdin{ codec <span class="cm-operator">=</span>&gt; <span class="cm-string">"json"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  file {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  path <span class="cm-operator">=</span>&gt; [<span class="cm-string">"/tmp/a.log"</span>,<span class="cm-string">"/tmp/b.log"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">......</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">验证配置,创建日志文件，启动logstash服务</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">重开一个logstash终端，写入日志数据</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-builtin">echo</span> A_<span class="cm-def">${RANDOM}</span>  每次都会输出不同的数据【RANDOM】为随机数的环境变量，写入数据后，回到logstash服务终端下查看，会有对应的数据输出</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># echo  A_${RANDOM} &gt;&gt; /tmp/a.log </span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># echo  B_${RANDOM} &gt;&gt; /tmp/b.log </span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">在启动logstash服务的终端查看数据输出结果 </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">file 插件常用参数</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">type <span class="cm-operator">=</span>&gt; <span class="cm-string">'testlog'</span><span class="cm-tab" role="presentation" cm-text="	">   </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-comment">#type 提供一个字符串标记</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">type字符串标记的使用,对来自不同服务的日志打标签，区别日志来源</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/logstash/conf.d/my.conf</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">input{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  stdin{ codec <span class="cm-operator">=</span>&gt; <span class="cm-string">"json"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  file {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  path <span class="cm-operator">=</span>&gt; [<span class="cm-string">"/tmp/a.log"</span>] </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  type <span class="cm-operator">=</span>&gt; <span class="cm-string">"weblog"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  file {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  path <span class="cm-operator">=</span>&gt; [<span class="cm-string">"/tmp/b.log"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  type <span class="cm-operator">=</span>&gt; <span class="cm-string">"dblog"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">......</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">重开一个终端，写入日志数据</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># echo  A_${RANDOM} &gt;&gt; /tmp/a.log </span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># echo  B_${RANDOM} &gt;&gt; /tmp/b.log </span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">在启动logstash服务的终端查看数据输出结果</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">file模块中，start_position和 sincedb_path 的使用 </span></pre><div class="" style="position: relative;"><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">start_position <span class="cm-operator">=</span>&gt; &nbsp;<span class="cm-string">"beginning"</span><span class="cm-tab" role="presentation" cm-text="	">  </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-comment">#start_position第一次读取文件位置 [beginning文件开始读取 | end，丢弃之前的日志，不在读取];</span></span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">sincedb_path <span class="cm-operator">=</span>&gt; &nbsp;<span class="cm-string">"/var/lib/logstash/sincedb-access"</span><span class="cm-tab" role="presentation" cm-text="	"> </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-comment">#sincedb_path 记录读取文件的位置，让logstash每次读取数据时，都是继续上次的位置，继续读取日志数据</span></span></pre><div class="" style="position: relative;"><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">创建日志文件，添加数据</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/logstash/conf.d/my.conf</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">input{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  stdin{ codec <span class="cm-operator">=</span>&gt; <span class="cm-string">"json"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  file {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  path <span class="cm-operator">=</span>&gt; [<span class="cm-string">"/tmp/c.log"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  type <span class="cm-operator">=</span>&gt; <span class="cm-string">"weblog"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">......</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># echo  C_${RANDOM} &gt;&gt; /tmp/c.log </span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># echo  C_${RANDOM} &gt;&gt; /tmp/c.log </span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">此时启动配置文件，数据是读取不到的</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">修改配置文件</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/logstash/conf.d/my.conf<span class="cm-tab" role="presentation" cm-text="	"> </span></span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">input{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  stdin{ codec <span class="cm-operator">=</span>&gt; <span class="cm-string">"json"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  file {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  path <span class="cm-operator">=</span>&gt; [<span class="cm-string">"/tmp/c.log"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  type <span class="cm-operator">=</span>&gt; <span class="cm-string">"weblog"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  start_position <span class="cm-operator">=</span>&gt; <span class="cm-string">"beginning"</span></span></pre><div class="" style="position: relative;"><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  sincedb_path <span class="cm-operator">=</span>&gt; &nbsp;<span class="cm-string">"/var/lib/logstash/sincedb"</span></span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">......</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">使用配置文件启动logstash服务,输出c.log中之前的日志数据</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">ctrl<span class="cm-operator">+</span>c 停止logstash的服务</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># echo  A_${RANDOM} &gt;&gt; /tmp/c.log <span class="cm-tab" role="presentation" cm-text="	"> </span>向c.log中继续添加数据</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># echo  A_${RANDOM} &gt;&gt; /tmp/c.log </span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">在启动logstash服务查看输出结果，是接着上次的位置继续读取的</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash</span></span></pre><div class="" style="position: relative;"><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre></div><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">注意：start_position <span class="cm-operator">=</span>&gt; <span class="cm-string">"beginning"</span> 设置完之后，还设置了sincedb_path <span class="cm-operator">=</span>&gt; &nbsp;<span class="cm-string">"/var/lib/logstash/sincedb"</span>，记录文件读取的位置，如果不进行设置，把默认的记录位置文件删除之后，是会每次都重复读取数据的</span></pre></div></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 2576px;"></div><div class="CodeMirror-gutters" style="display: none; height: 2576px;"></div></div></div></pre><h4><a name="filter-grok插件" class="md-header-anchor"></a><span>filter grok插件</span></h4><blockquote><p><span>正则表达式分组匹配格式: (?&lt;名字&gt;正则表达式)</span>
<span>正则表达式宏调用格式: %{宏名称:名字}</span>
<span>宏文件路径 :</span>
<span>/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-patterns-core-4.1.2/patterns</span></p></blockquote><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="shell" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="shell"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 3.60001px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre>x</pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">编写logstash中的filter区域，logstash的配置文件，方便filter区域的调试</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">环境准备：</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/logstash/conf.d/my.conf</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">input{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  stdin{ codec <span class="cm-operator">=</span>&gt; <span class="cm-string">"json"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  file {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  path <span class="cm-operator">=</span>&gt; [<span class="cm-string">"/tmp/c.log"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  type <span class="cm-operator">=</span>&gt; <span class="cm-string">"weblog"</span></span></pre><div class="" style="position: relative;"><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  start_position <span class="cm-operator">=</span>&gt; <span class="cm-string">"beginning"</span> &nbsp;</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;"> &nbsp; &nbsp;<span class="cm-comment">#sincedb_path =&gt; "/var/lib/logstash/sincedb"<span class="cm-tab" role="presentation" cm-text="	">    </span>#取消记录下次读取日志位置文件</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  sincedb_path <span class="cm-operator">=</span>&gt; <span class="cm-string">"/dev/null"</span><span class="cm-tab" role="presentation" cm-text="	"> </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-comment">#将记录位置定义为黑洞设备</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">...</span></pre><div class="" style="position: relative;"><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre></div><div class="" style="position: relative;"><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">修改c.log日志文件，便于输出查看，只留一条apache日志记录</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># echo '192.168.1.252 - - [29/Jul/2022:14:06:57 +0800] "GET /info.html HTTP/1.1" 200 119 "-" "curl/7.29.0"' &gt;/tmp/c.log</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">采用的logstash提供的宏来匹配过滤IP地址</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/logstash/conf.d/my.conf</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">......</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">filter{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp;  grok {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp;  match <span class="cm-operator">=</span>&gt; { <span class="cm-string">"message"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"%{IP:client_ip}"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp;  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">......</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">启动logstash服务，查看匹配结果</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash<span class="cm-tab" role="presentation" cm-text="	"> </span><span class="cm-tab" role="presentation" cm-text="	">    </span>#客户端IP地址匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">采用的logstash提供的宏来匹配apache日志格式；remove_field：删除message的信息</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/logstash/conf.d/my.conf</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">......</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">filter{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  grok {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  match <span class="cm-operator">=</span>&gt; { <span class="cm-string">"message"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"%{HTTPD_COMBINEDLOG}"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  remove_field <span class="cm-operator">=</span>&gt; [<span class="cm-string">"message"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">......</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">启动logstash服务，查看匹配结果</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">...</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp;<span class="cm-string">"@version"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"1"</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp;<span class="cm-string">"@timestamp"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"2022-10-31T03:33:49.240Z"</span>,</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; <span class="cm-string">"clientip"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"192.168.1.252"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-comment">#IP地址匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"ident"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"-"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#远程登录名(由identd而来，如果支持)匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-string">"auth"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"-"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#远程用户名：根据验证信息而来，如使用了Basic 认证</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; <span class="cm-string">"timestamp"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"30/Oct/2022:21:45:19 +0800"</span> &nbsp; &nbsp; <span class="cm-comment">#时间戳匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-string">"verb"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"GET"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#请求方法匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"url"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"/favicon.ico"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-comment">#url路径匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"proto"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"HTTP"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-comment">#访问协议匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"ver"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"1.1"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#版本匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-string">"rc"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"200"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#页面返回状态码匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-string">"bytes"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"1"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-comment">#页面大小匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"referrer"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"http://192.168.1.100/"</span>, &nbsp;<span class="cm-comment">#前导页匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"agent"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0"</span> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#客户端主机信息匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 1667px;"></div><div class="CodeMirror-gutters" style="display: none; height: 1667px;"></div></div></div></pre><h4><a name="output-elasticsearch插件" class="md-header-anchor"></a><span>output elasticsearch插件</span></h4><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="shell" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="shell"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 3.60001px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">在elaticsearch模块的帮助文档中查找，output 区域的配置https://www.elastic.co/guide/en/logstash/current/index.html</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">会发现没有必须的配置，定义一个index索引名称和host指定elaticsearch服务器的地址即可，配置多台，可以实现系统的负载均衡和高可用</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/logstash/conf.d/my.conf</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">input { </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  file {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  path <span class="cm-operator">=</span>&gt; [<span class="cm-string">"/tmp/c.log"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  type <span class="cm-operator">=</span>&gt; <span class="cm-string">"weblog"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  start_position <span class="cm-operator">=</span>&gt; <span class="cm-string">"beginning"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  sincedb_path <span class="cm-operator">=</span>&gt; <span class="cm-string">"/var/lib/logstash/sincedb"</span><span class="cm-tab" role="presentation" cm-text="	"> </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-comment">#位置还改为记录下次读取日志位置文件</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">filter{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  grok {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  match <span class="cm-operator">=</span>&gt; { <span class="cm-string">"message"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"%{HTTPD_COMBINEDLOG}"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  remove_field <span class="cm-operator">=</span>&gt; [<span class="cm-string">"message"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">output{ </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  stdout{ codec <span class="cm-operator">=</span>&gt; <span class="cm-string">"rubydebug"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  elasticsearch {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  hosts <span class="cm-operator">=</span>&gt; [<span class="cm-string">"es-0004:9200"</span>, <span class="cm-string">"es-0005:9200"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  index <span class="cm-operator">=</span>&gt; <span class="cm-string">"weblog-%{+YYYY.MM.dd}"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">web主机获取apache日志记录</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@web-0001 ~]<span class="cm-comment"># cat /var/log/httpd/access_log</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /tmp/c.log<span class="cm-tab" role="presentation" cm-text="	">   </span><span class="cm-tab" role="presentation" cm-text="	">    </span>#把cat查看的最后一行数据复制到c.log中</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">100</span>.125.24.26 <span class="cm-attribute">-</span> <span class="cm-attribute">-</span> [08/Jun/2023:03:35:29 <span class="cm-operator">+</span><span class="cm-number">0800</span>] <span class="cm-string">"GET /es-head/ HTTP/1.1"</span> <span class="cm-number">401</span> <span class="cm-number">381</span> <span class="cm-string">"-"</span> <span class="cm-string">"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.71 Safari/537.36"</span></span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 960px;"></div><div class="CodeMirror-gutters" style="display: none; height: 960px;"></div></div></div></pre><p><span>浏览器打开 head 插件，通过 web 页面浏览验证</span></p><p><img src="cloud_01.assets/image-20230608220919456.png" referrerpolicy="no-referrer" alt="image-20230608220919456"></p><h1><a name="web日志分析实战" class="md-header-anchor"></a><span>WEB日志分析实战</span></h1><h2><a name="beats配置" class="md-header-anchor"></a><span>beats配置</span></h2><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="shell" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="shell"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 3.60001px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">从web服务器收集日志</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;<span class="cm-attribute">-</span> [x] 由于 logstash 依赖 JAVA 环境，而且占用资源非常大，因此在每一台web服务器上部署 logstash 非常不合适</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;<span class="cm-attribute">-</span> [x] 使用更轻量的 filebeat 替代</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;<span class="cm-attribute">-</span> [x] filebeat  非常轻量，没有依赖</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;<span class="cm-attribute">-</span> [x] filebeat  可以通过网络给 logstash 发送数据</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">beats插件使用</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/logstash/conf.d/my.conf</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">input { </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  beats {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  port <span class="cm-operator">=</span>&gt; <span class="cm-number">5044</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">} </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">filter{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  grok {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  match <span class="cm-operator">=</span>&gt; { <span class="cm-string">"message"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"%{HTTPD_COMBINEDLOG}"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  remove_field <span class="cm-operator">=</span>&gt; [<span class="cm-string">"message"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">output{ </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  stdout{ codec <span class="cm-operator">=</span>&gt; <span class="cm-string">"rubydebug"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  elasticsearch {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  hosts <span class="cm-operator">=</span>&gt; [<span class="cm-string">"es-0004:9200"</span>, <span class="cm-string">"es-0005:9200"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  index <span class="cm-operator">=</span>&gt; <span class="cm-string">"apachelog-%{+YYYY.MM.dd}"</span><span class="cm-tab" role="presentation" cm-text="	"> </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-comment">#更改索引名字</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash</span></span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 732px;"></div><div class="CodeMirror-gutters" style="display: none; height: 732px;"></div></div></div></pre><h2><a name="filebeat安装配置" class="md-header-anchor"></a><span>filebeat安装配置</span></h2><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="shell" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="shell"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 3.60001px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@ecs-proxy ~]<span class="cm-comment"># ssh 192.168.1.11</span></span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@web-0001 ~]<span class="cm-comment"># yum -y install filebeat</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@web-0001 ~]<span class="cm-comment"># vim /etc/filebeat/filebeat.yml</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">24</span>:  enabled: <span class="cm-atom">true</span> <span class="cm-comment"># 启用收集模块</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">28</span>: &nbsp;<span class="cm-attribute">-</span> /var/log/httpd/access_log &nbsp;<span class="cm-comment">#定义日志路径</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">45</span> &nbsp; fields:<span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-comment">#自定义日志字段，方便用户区分日志来源</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">46</span> &nbsp; &nbsp; logtype: apache<span class="cm-tab" role="presentation" cm-text="	">  </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span> <span class="cm-comment">#定义名称</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;"><span class="cm-number">149</span> <span class="cm-comment">#output.elasticsearch:<span class="cm-tab" role="presentation" cm-text="	">  </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span> #加上#号</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;"><span class="cm-number">151</span> &nbsp; <span class="cm-comment">#hosts: ["localhost:9200"]<span class="cm-tab" role="presentation" cm-text="	">    </span>  #加上#号</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">162</span> output.logstash: <span class="cm-tab" role="presentation" cm-text="	">   </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span> <span class="cm-comment">#输出到logstash</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">164</span> &nbsp; hosts: [<span class="cm-string">"192.168.1.27:5044"</span>] &nbsp; &nbsp; &nbsp;<span class="cm-comment">#logstash地址</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;"><span class="cm-number">180</span> <span class="cm-comment">#processors:<span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span> &nbsp; &nbsp; #收集系统相关信息，可以注释掉</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;"><span class="cm-number">181</span> &nbsp; <span class="cm-comment">#- add_host_metadata: ~<span class="cm-tab" role="presentation" cm-text="	">   </span><span class="cm-tab" role="presentation" cm-text="	">    </span>  #收集系统相关信息，可以注释掉</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;"><span class="cm-number">182</span> &nbsp; <span class="cm-comment">#- add_cloud_metadata: ~<span class="cm-tab" role="presentation" cm-text="	">  </span><span class="cm-tab" role="presentation" cm-text="	">    </span>  #收集系统相关信息，可以注释掉</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@web-0001 ~]<span class="cm-comment"># systemctl enable --now filebeat </span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">使用命令行访问web-0001，内网访问</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@web-0001 ~]<span class="cm-comment"># curl 192.168.1.11/info.php</span></span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 463px;"></div><div class="CodeMirror-gutters" style="display: none; height: 463px;"></div></div></div></pre><p><span>可以看到logstash启动页面有数据，已经解析成功</span></p><p><img src="cloud_01.assets/image-20230608224725484.png" referrerpolicy="no-referrer" alt="image-20230608224725484"></p><p><span>elasticsearch集群已经有索引数据出现</span></p><p><img src="cloud_01.assets/image-20230608224751025.png" referrerpolicy="no-referrer" alt="image-20230608224751025"></p><h3><a name="logstash额外配置" class="md-header-anchor"></a><span>logstash额外配置</span></h3><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="shell" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="shell"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 3.60001px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">扩展：目前虽然已经可以收集到数据，但是如果logstash需要收集不同服务的日志，可以做匹配，如</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-tab" role="presentation" cm-text="	">    </span>apache的日志进入logstash <span class="cm-attribute">--</span>》 apache的过滤规则</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-tab" role="presentation" cm-text="	">    </span>nginx 的日志进入logstash <span class="cm-attribute">--</span>》 nginx 的过滤规则</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-tab" role="presentation" cm-text="	">    </span>数据库的日志进入logstash <span class="cm-attribute">--</span>》 数据库的过滤规则</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># cat /etc/logstash/conf.d/my.conf</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">input { </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  beats {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  port <span class="cm-operator">=</span>&gt; <span class="cm-number">5044</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">filter{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;<span class="cm-keyword">if</span> [fields][logtype] <span class="cm-operator">==</span> <span class="cm-string">"apache"</span> {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  grok {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  match <span class="cm-operator">=</span>&gt; { <span class="cm-string">"message"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"%{HTTPD_COMBINEDLOG}"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  remove_field <span class="cm-operator">=</span>&gt; [<span class="cm-string">"message"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">output{ </span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  stdout{ codec <span class="cm-operator">=</span>&gt; <span class="cm-string">"rubydebug"</span> }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;<span class="cm-keyword">if</span> [fields][logtype] <span class="cm-operator">==</span> <span class="cm-string">"apache"</span> {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  elasticsearch {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  hosts <span class="cm-operator">=</span>&gt; [<span class="cm-string">"es-0004:9200"</span>, <span class="cm-string">"es-0005:9200"</span>]</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp;  index <span class="cm-operator">=</span>&gt; <span class="cm-string">"apachelog-%{+YYYY.MM.dd}"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">  }}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /usr/share/logstash/bin/logstash</span></span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 709px;"></div><div class="CodeMirror-gutters" style="display: none; height: 709px;"></div></div></div></pre><p><span>使用kibana进行数据可视化展示</span></p><p><img src="cloud_01.assets/image-20230608230432354.png" referrerpolicy="no-referrer" alt="image-20230608230432354"></p><p><img src="cloud_01.assets/image-20230608230456102.png" referrerpolicy="no-referrer" alt="image-20230608230456102"></p><p><img src="cloud_01.assets/image-20230608230852913.png" referrerpolicy="no-referrer" alt="image-20230608230852913"></p><p><img src="cloud_01.assets/image-20230608230911178.png" referrerpolicy="no-referrer" alt="image-20230608230911178"></p><p><img src="cloud_01.assets/image-20230608230933928.png" referrerpolicy="no-referrer" alt="image-20230608230933928"></p><p><img src="cloud_01.assets/image-20230608230948154.png" referrerpolicy="no-referrer" alt="image-20230608230948154"></p><p><img src="cloud_01.assets/image-20230608231023247.png" referrerpolicy="no-referrer" alt="image-20230608231023247"></p><p><img src="cloud_01.assets/image-20230608231037841.png" referrerpolicy="no-referrer" alt="image-20230608231037841"></p><p><img src="cloud_01.assets/image-20230608231055521.png" referrerpolicy="no-referrer" alt="image-20230608231055521"></p><p><img src="cloud_01.assets/image-20230608231115432.png" referrerpolicy="no-referrer" alt="image-20230608231115432"></p><p><img src="cloud_01.assets/image-20230608231125790.png" referrerpolicy="no-referrer" alt="image-20230608231125790"></p><p><img src="cloud_01.assets/image-20230608231137407.png" referrerpolicy="no-referrer" alt="image-20230608231137407"></p><p><img src="cloud_01.assets/image-20230608231151309.png" referrerpolicy="no-referrer" alt="image-20230608231151309"></p><p>&nbsp;</p><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="shell"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="shell"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 3.60001px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">测试：</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">方法一，直接在内网中访问：</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># for i in {1..10}</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">&gt; <span class="cm-keyword">do</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">&gt; <span class="cm-builtin">curl</span> <span class="cm-number">192</span>.168.1.11/info.php</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">&gt; <span class="cm-keyword">done</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">方法二：把web-0001主机发布到互联网上，可以让其他人访问测试，查看结果</span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 202px;"></div><div class="CodeMirror-gutters" style="display: none; height: 202px;"></div></div></div></pre><p><span>kibana页面设置刷新时间</span></p><p><img src="cloud_01.assets/image-20230608231333799.png" referrerpolicy="no-referrer" alt="image-20230608231333799"></p><p><span>可以看到已经自动刷新</span></p><p><img src="cloud_01.assets/image-20230608231525195.png" referrerpolicy="no-referrer" alt="image-20230608231525195"></p><p>&nbsp;</p><h1><a name="补充" class="md-header-anchor"></a><span>补充</span></h1><pre spellcheck="false" class="md-fences md-end-block ty-contain-cm modeLoaded" lang="shell" style="break-inside: unset;"><div class="CodeMirror cm-s-inner CodeMirror-wrap" lang="shell"><div style="overflow: hidden; position: relative; width: 3px; height: 0px; top: 0px; left: 3.60001px;"><textarea autocorrect="off" autocapitalize="off" spellcheck="false" tabindex="0" style="position: absolute; bottom: -1em; padding: 0px; width: 1000px; height: 1em; outline: none;"></textarea></div><div class="CodeMirror-scrollbar-filler" cm-not-content="true"></div><div class="CodeMirror-gutter-filler" cm-not-content="true"></div><div class="CodeMirror-scroll" tabindex="-1"><div class="CodeMirror-sizer" style="margin-left: 0px; margin-bottom: 0px; border-right-width: 0px; padding-right: 0px; padding-bottom: 0px;"><div style="position: relative; top: 0px;"><div class="CodeMirror-lines" role="presentation"><div role="presentation" style="position: relative; outline: none;"><div class="CodeMirror-measure"><pre><span>xxxxxxxxxx</span></pre></div><div class="CodeMirror-measure"></div><div style="position: relative; z-index: 1;"></div><div class="CodeMirror-code" role="presentation" style=""><div class="CodeMirror-activeline" style="position: relative;"><div class="CodeMirror-activeline-background CodeMirror-linebackground"></div><div class="CodeMirror-gutter-background CodeMirror-activeline-gutter" style="left: 0px; width: 0px;"></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">apache日志格式含义：</span></pre></div><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">100</span>.125.24.92 <span class="cm-attribute">-</span> admin [08/Jun/2023:23:36:04 <span class="cm-operator">+</span><span class="cm-number">0800</span>] <span class="cm-string">"GET /es/_nodes/stats HTTP/1.1"</span> <span class="cm-number">200</span> <span class="cm-number">6418</span> <span class="cm-string">"http://122.9.71.198/es-head/"</span> <span class="cm-string">"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">100</span>.125.24.92<span class="cm-tab" role="presentation" cm-text="	">   </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span> &nbsp; <span class="cm-comment">#IP地址</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-attribute">-</span> <span class="cm-tab" role="presentation" cm-text="	">  </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span> &nbsp;<span class="cm-comment">#远程登录名(由identd而来，如果支持)匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">admin <span class="cm-tab" role="presentation" cm-text="	">  </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span> &nbsp;<span class="cm-comment">#远程用户名：根据验证信息而来，如使用了Basic 认证</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[08/Jun/2023:23:36:04 <span class="cm-operator">+</span><span class="cm-number">0800</span>] <span class="cm-tab" role="presentation" cm-text="	">   </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-comment">#时间戳</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;"><span class="cm-string">"GET <span class="cm-tab" role="presentation" cm-text="	">   </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span>  #请求方法</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">/es/_nodes/stats <span class="cm-tab" role="presentation" cm-text="	">   </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span> &nbsp; <span class="cm-comment">#url路径</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">HTTP<span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span> &nbsp;<span class="cm-comment">#访问协议</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" class="cm-tab-wrap-hack" style="padding-right: 0.1px;"><span class="cm-number">1</span>.1<span class="cm-string">" <span class="cm-tab" role="presentation" cm-text="	">   </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span>  #版本</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">200</span> <span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span> &nbsp;<span class="cm-comment">#页面返回状态码</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-number">6418</span> <span class="cm-tab" role="presentation" cm-text="	">   </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-tab" role="presentation" cm-text="	">    </span> &nbsp;<span class="cm-comment">#页面大小</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-string">"http://122.9.71.198/es-head/"</span> <span class="cm-tab" role="presentation" cm-text="	"> </span><span class="cm-tab" role="presentation" cm-text="	">    </span><span class="cm-comment">#前导页</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-string">"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"</span><span class="cm-tab" role="presentation" cm-text="	">   </span> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#客户端主机信息</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">注：</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">Identd是一个服务程序，它在服务器上运行并响应Ident协议的请求。当客户端连接到服务器时，服务器会建立一个Ident请求到客户端所在的主机，并在Identd程序上查询此请求的用户标识信息</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">Ident是一种协议，它用于获取用户标识信息；而Identd是一个实现Ident协议的服务程序，它用于响应Ident查询请求</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span cm-text="">​</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">使用正则匹配日志数据</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-comment">####grok插件使用模板，grok的编写采用的是正则表达式</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-comment">#\d 匹配0-9的数字；\S 匹配非空字符; ? 匹配前一个字符1次；. 代表任意单个字符；</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"><span class="cm-comment">#() 限定字符；+ 匹配前一个字符一次以上；\ 为转义符号，取消特殊含义</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># vim /etc/logstash/logstash.conf </span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">............</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">filter{</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp;  grok {</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp;  match <span class="cm-operator">=</span>&gt; { <span class="cm-string">"message"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"(?&lt;client_ip&gt;([12]?\d?\d\.){3}[12]?\d?\d) (?&lt;rhost&gt;\S+) (?&lt;vber&gt;\S+) \[(?&lt;time&gt;.+)\] \"(?&lt;method&gt;[A-Z]+) (?&lt;url&gt;\S+) (?&lt;proto&gt;[A-Z]+)\/(?&lt;ver&gt;[0-9.]+)\" (?&lt;rc&gt;\d+) (?&lt;size&gt;\d+) \"(?&lt;ref&gt;\S+)\" \"(?&lt;agent&gt;[^\"]+)\""</span>}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp;  }</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">启动logstash服务，查看匹配结果</span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">[root@logstash ~]<span class="cm-comment"># /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf </span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; <span class="cm-string">"client_ip"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"192.168.8.1"</span> &nbsp; &nbsp; &nbsp;  <span class="cm-tab" role="presentation" cm-text="	">   </span><span class="cm-tab" role="presentation" cm-text="	">    </span> &nbsp;<span class="cm-comment">#IP地址匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"rhost"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"-"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#远程登录名(由identd而来，如果支持)匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-string">"vber"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"-"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#远程用户名：根据验证信息而来，如使用了Basic 认证</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-string">"time"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"30/Oct/2022:21:45:19 +0800"</span> &nbsp; <span class="cm-comment">#时间戳匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-string">"method"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"GET"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#请求方法匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"url"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"/favicon.ico"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-comment">#url路径匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"proto"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"HTTP"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-comment">#访问协议匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"ver"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"1.1"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#版本匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-string">"rc"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"200"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#页面返回状态码匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-string">"size"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"1"</span>, &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#页面大小匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"ref"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"http://192.168.8.48/"</span>, &nbsp; &nbsp; &nbsp; &nbsp;<span class="cm-comment">#前导页匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;"> &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-string">"agent"</span> <span class="cm-operator">=</span>&gt; <span class="cm-string">"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0"</span> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <span class="cm-comment">#客户端主机信息匹配出来</span></span></pre><pre class=" CodeMirror-line " role="presentation"><span role="presentation" style="padding-right: 0.1px;">}</span></pre></div></div></div></div></div><div style="position: absolute; height: 0px; width: 1px; border-bottom: 0px solid transparent; top: 1477px;"></div><div class="CodeMirror-gutters" style="display: none; height: 1477px;"></div></div></div></pre><p>&nbsp;</p></div>
</body>
</html>